Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 01:24
Behavioral task
behavioral1
Sample
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe
Resource
win10v2004-20240226-en
General
-
Target
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe
-
Size
1.3MB
-
MD5
4bfab2a3f499cf756a71c8122a2a76cf
-
SHA1
34d627c279a7442411dcd4aa012c8eb9b2051d7d
-
SHA256
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4
-
SHA512
8af695f2837ff191d38ba7c881f866e5a9d8d70aa92d21d7f79446c2aaab8879c397de8d1daad6a08c270b98628ac5d3e685f3290868aef8e37683d336b2417e
-
SSDEEP
24576:VuQvdg5zMMmASE08tpUQ0abZG+0YVwy/JAFwRjW54WInUmwKIurYm658egw:DVyzMISb8teQ0abZYYVwy/owRjYBInUf
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
Processes:
resource yara_rule behavioral2/memory/3120-111-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1936-166-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1936-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-189-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-194-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-204-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-207-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-211-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-214-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-217-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-220-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-223-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-226-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-229-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-232-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1704-235-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 19 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x0007000000023227-5.dat UPX behavioral2/memory/3120-111-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1936-166-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1936-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-189-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-194-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-204-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-207-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-211-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-214-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-217-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-220-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-223-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-226-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-229-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-232-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1704-235-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exec945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1704-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0007000000023227-5.dat upx behavioral2/memory/3120-111-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1936-166-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1936-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-194-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-204-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-207-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-211-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-214-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-217-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-220-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-223-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-226-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-229-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-232-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1704-235-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process File opened (read-only) \??\M: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\Q: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\R: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\S: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\T: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\U: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\W: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\J: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\Z: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\L: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\N: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\P: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\A: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\E: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\G: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\K: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\O: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\V: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\Y: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\B: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\I: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\X: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File opened (read-only) \??\H: c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Drops file in System32 directory 12 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process File created C:\Windows\SysWOW64\FxsTmp\american trambling [milf] (Anniston).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\IME\SHARED\russian sperm horse public stockings .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\fucking gay sleeping (Sarah,Sonja).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian bukkake licking femdom .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish cum horse voyeur nipples circumcision .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\FxsTmp\german blowjob sleeping (Jade,Tatjana).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\config\systemprofile\french animal nude voyeur hole (Christine,Christine).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\System32\DriverStore\Temp\fucking girls 50+ .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\config\systemprofile\horse [free] (Jade).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\IME\SHARED\norwegian fucking cumshot public vagina 40+ .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\cumshot lesbian .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\blowjob girls .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Drops file in Program Files directory 18 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\bukkake lesbian girls .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Common Files\microsoft shared\asian gang bang lesbian ash leather .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\root\Templates\russian xxx sperm voyeur bedroom .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude hidden .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\swedish lingerie cum masturbation legs fishy (Sonja).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\nude kicking voyeur .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\Updates\Download\american sperm beast hidden sm .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\dotnet\shared\kicking porn lesbian upskirt (Kathrin,Sandy).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\lesbian public feet .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\beastiality [free] .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Google\Update\Download\indian gay uncut .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\asian horse kicking full movie .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Microsoft\Temp\beast animal big pregnant .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\japanese fucking [milf] .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\french gay lesbian legs beautyfull (Sonja,Britney).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian hardcore several models ash femdom .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\action [milf] shoes (Sonja).avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Program Files (x86)\Google\Temp\african bukkake hot (!) lady .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Drops file in Windows directory 64 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\indian porn gang bang sleeping castration .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\fetish hot (!) nipples redhair .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\italian beast catfight castration .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\norwegian fetish licking hole .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\gay beast hot (!) glans redhair .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\russian horse lesbian legs (Jade).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\fetish catfight swallow .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\kicking fucking uncut (Tatjana).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\italian gang bang licking bondage (Sonja).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\gay [free] .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\indian porn hidden feet .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\british beastiality sleeping bedroom .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish fucking hot (!) granny (Christine,Karin).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\italian kicking sleeping YEâPSè& (Melissa).mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\russian bukkake fetish hot (!) .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\beastiality [milf] boobs bedroom .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\hardcore [milf] pregnant .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\british beast beastiality hidden .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\malaysia blowjob [free] .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\beastiality voyeur fishy (Melissa).avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\malaysia xxx [bangbus] .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\kicking hot (!) traffic .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\french sperm lingerie girls leather (Christine).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\german lingerie full movie (Jenna,Karin).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\hardcore blowjob sleeping cock upskirt .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\CbsTemp\cum cumshot uncut wifey (Jenna,Sarah).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\african blowjob lingerie hidden circumcision .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\danish horse gang bang sleeping (Sylvia).mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\german xxx full movie upskirt .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\french bukkake xxx uncut feet .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\american gang bang masturbation vagina .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\lingerie action [bangbus] girly .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\danish lingerie uncut .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\black gang bang horse catfight feet lady .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\german animal licking gorgeoushorny (Samantha,Sylvia).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\danish nude voyeur glans beautyfull .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\asian animal trambling girls ash bondage (Sonja,Melissa).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\brasilian fucking [bangbus] titts .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\american horse horse uncut hole 40+ .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\russian horse trambling [free] hairy (Sonja,Ashley).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\gang bang lingerie [milf] bedroom .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\beastiality voyeur boobs girly .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\cum bukkake hidden vagina circumcision (Sonja).avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\kicking voyeur upskirt .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\tyrkish trambling horse masturbation penetration .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\InputMethod\SHARED\handjob cumshot full movie glans (Jenna).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\asian trambling animal lesbian granny .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\malaysia sperm lesbian ash 40+ (Jade,Karin).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\canadian horse beastiality girls bedroom (Gina,Karin).mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\asian gang bang catfight redhair .mpeg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\InstallTemp\swedish trambling beastiality voyeur .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\italian blowjob animal girls .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\russian horse girls glans (Sonja,Liz).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\danish fucking lingerie licking cock hotel (Jenna,Karin).zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\mssrv.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\nude voyeur young .zip.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\french lingerie public .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\asian animal cumshot girls vagina upskirt (Ashley,Gina).rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\fucking voyeur cock .avi.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\beast xxx masturbation bondage .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\swedish fetish lesbian hairy .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\chinese lesbian cumshot [bangbus] granny .mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\black trambling trambling sleeping hole lady (Karin).mpg.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\indian horse beastiality hidden legs 50+ .rar.exe c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exec945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exec945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exepid Process 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1936 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exec945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exedescription pid Process procid_target PID 1704 wrote to memory of 3120 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 88 PID 1704 wrote to memory of 3120 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 88 PID 1704 wrote to memory of 3120 1704 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 88 PID 3120 wrote to memory of 1936 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 89 PID 3120 wrote to memory of 1936 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 89 PID 3120 wrote to memory of 1936 3120 c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"C:\Users\Admin\AppData\Local\Temp\c945147ee06fffd81cc1e08c816585a3a000bfe59445ddfac439c19ca75b0df4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude hidden .mpeg.exe
Filesize1.6MB
MD54bdc68230765d590d610f21d99566faa
SHA11aba658d413a5f245ae6fd48928d85a198b82d40
SHA256b9fd6355d34f3b2cdd2fb56dcb5689fe957d78b09c5238f1a912775fe88e75ea
SHA5128bd47e5ff4cd9eeefa321d5297486e47e77bb09b0d8d5d263810732ae1849535ddb7cbbeb30921a531ebeb20d058e954f22ee255d2d6560ec6c4b9198670534c